Domain 1: Network Security Fundamentals
- The control plane (management plane) handles configuration, administrative access, reporting, log correlation, and update coordination, while the data plane performs session matching, decryption, and packet forwarding. Separating them protects forwarding throughput so a burst of management activity does not starve live traffic processing.
- Zero Trust is built on the 'never trust, always verify' tenet: every access request is continuously verified by identity, device posture, and context, enforcing least-privilege identity-based access regardless of network location.
- App-ID lets security policy match the application itself independent of the port it uses, unlike legacy port-based firewalls.
- A default gateway supplies the next-hop router address a host uses to reach any off-subnet (off-local-network) destination; the host does not route between networks itself.
- The Network layer (Layer 3) of the OSI model handles logical addressing and routing.
- NAT conserves public IPv4 addresses and obscures internal addressing; the post-NAT (translated) destination determines the egress zone used for policy.
- A Secure Web Gateway (SWG) inspects and filters outbound user web-browsing traffic, blocking malicious or inappropriate sites and enforcing acceptable-use and URL-category policy.
- SASE combines SSE's cloud-delivered security services with SD-WAN networking, whereas SSE alone excludes SD-WAN and focuses only on security.
- Prisma Access is the cloud-delivered SASE platform that secures mobile users and remote sites and delivers network security without per-site hardware; FWaaS brings firewall protection to new branches without procuring physical appliances.
- A virtual router is an independent routing instance with its own routing table; a tunnel interface is the logical interface used to route traffic into and out of a VPN/IPsec tunnel.
- Insider threats fall into malicious insiders and negligent insiders; phishing is a social-engineering attack that manipulates users into revealing credentials or running malware.
- A fixed data center or campus with high, steady local traffic best fits an on-premises NGFW appliance, while distributed remote users are better served by SASE points of presence closer to the user.
Domain 2: NGFW and SASE Solution Functionality
- Single-pass parallel processing scans a packet once and runs multiple inspection functions concurrently, reducing latency versus sequential, repeated scanning engines.
- App-ID provisionally classifies a new session from early context and refines it as more packets arrive; valid unclassified states include unknown-tcp, unknown-udp, and incomplete (the handshake did not finish or lacked enough data). application-default is a policy service setting, not an App-ID state.
- The Cloud Identity Engine synchronizes directory user and group data into the cloud to feed User-ID-based, identity-driven policy without replicating the whole directory infrastructure.
- A Security Profile Group bundles multiple security profiles (Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, WildFire Analysis) so they attach to a rule as one unit. Profiles are evaluated only on traffic the rule's action permits.
- The Anti-Spyware profile detects command-and-control and spyware phone-home traffic from compromised hosts; its DNS Policies support Sinkhole and Block actions for matched DNS signature categories.
- Block IP is the Vulnerability Protection action that blocks all further traffic from the offending source (or source-destination pair) for a configured duration.
- Prisma Access supports unified policy management across mobile users, remote networks, and service connections from a single management interface.
- Remote Networks onboarding uses the branch's existing router or SD-WAN device to establish an IPsec or GRE tunnel to the nearest Prisma Access location; the branch keeps routing and Prisma Access applies security.
- SD-WAN provides branch path selection using latency, jitter, and packet-loss measurements plus link bandwidth capacity; a blackout means a link has lost connectivity entirely. Common transports are MPLS, broadband internet, and LTE/cellular.
- Service Connections reach data center and HQ resources and are deployed in fewer numbers than Remote Networks; hubs aggregate spoke connections and provide centralized resource access, typically at headquarters or regional sites.
- Inline CASB inspects SaaS traffic in real time as it flows through Prisma Access, while API-based CASB scans data at rest inside sanctioned SaaS applications.
- The 'prone to misuse' application tag flags apps historically used to evade controls or associated with malicious activity.
Domain 3: Platform Solutions, Services, and Tools
- Strata Cloud Manager (SCM) is the unified cloud-delivered console spanning on-premises NGFW, Prisma Access, and SD-WAN for hybrid architectures.
- Advanced WildFire (Advanced WildFire) runs unknown files in an isolated cloud sandbox and returns granular verdicts: benign, grayware, phishing, or malicious.
- Advanced Threat Prevention and Advanced URL Filtering perform inline ML/deep-learning analysis directly in the firewall's data path in real time; Advanced Threat Prevention detects obfuscated SQL and command-injection attempts. Licensing alone is insufficient - the security profile must be attached to a policy rule.
- IoT Security uses machine learning to discover and classify connected devices (type, vendor, model) without manual inventory, assigns risk scores, and recommends access and segmentation policies.
- AIOps for NGFW is tiered: the Premium tier provides longer telemetry retention and broader best-practice and predictive insight than the Free tier.
- The Best Practice Assessment (BPA) produces findings and an overall score reflecting alignment with recommended security configuration practices.
- In Panorama, Device Groups organize policy: a device group has exactly one parent, and pushed pre-rules and post-rules bracket the firewall's local rules (local rules sit between pushed pre- and post-rules). Templates and template stacks combine settings applied to firewalls; SCM Folders organize configuration hierarchically for scoping and inheritance.
- Logs can be centralized to Panorama Log Collectors, the Strata Logging Service, or syslog servers; a syslog server profile supports UDP, TCP, or SSL transport.
- Key log types: Traffic (session details for policy-matched sessions), WildFire Submissions (verdicts for submitted files), Correlation (automated correlation-engine matches), and Data Filtering (data pattern and File Blocking profile matches).
- A custom report queries the log database with administrator-chosen columns, filters, sorting, and time range, and can be scheduled for recurring delivery.
- Server profiles route notifications and logs: Email server profiles send immediate alerts on matching log entries; the Cloud Identity Engine shares consistent user/group identity across managed firewalls and Prisma Access.
Domain 4: NGFW and SASE Solution Maintenance and Configuration
- Validate Commit runs the same checks a real commit performs and reports errors without merging the candidate into the running configuration; PAN-OS flags a rule shadowing warning when a broader earlier rule makes a later rule unreachable.
- Before upgrading, export and save a copy of the current configuration to an external location as a safe offline backup; use Revert to Running Configuration to discard uncommitted candidate changes.
- NAT policy is evaluated before security policy, and the security policy's egress zone is derived from a route lookup on the translated (post-NAT) destination.
- Interzone traffic (between two different zones) is governed by interzone rules; security profiles have no effect on rules whose action is Deny, since profiles only inspect allowed traffic.
- SSL Forward Proxy decrypts outbound client-to-internet HTTPS: the Forward Trust CA certificate signs impersonation certificates for trusted server certs and must be distributed to client trust stores (via GPO or MDM) to avoid certificate warnings.
- SSL Inbound Inspection requires importing the actual internal server certificate and its matching private key onto the firewall.
- In a decryption profile, the SSL Protocol Settings minimum-version option enforces a protocol floor such as TLS 1.2 for decrypted sessions and can block weak ciphers and outdated versions.
- Prisma Access licensing is sized on aggregate bandwidth and number of mobile users; Remote Network bandwidth is set by selecting a predefined tier matching the site's expected throughput.
- A single centralized rulebase applies consistently across all Prisma Access components (Mobile Users, Remote Networks, Service Connections); SAML SSO with the corporate IdP authenticates Mobile Users to the gateway.
- Static routes suit a small Remote Network with a stable subnet list, while BGP alone can advertise Remote Network subnets (duplicate static routes are not required).
- WildFire signatures can update as often as every minute with an active subscription (daily without one); the WildFire Analysis profile forwards matching unknown files for sandbox analysis. The new-App-ID handling setting adds a configurable delay before newly introduced App-IDs from a content update are enforced. Applications and Threats and the GlobalProtect Data File are valid dynamic content update types.
Domain 5: Infrastructure Management and CDSS
- CDSS and licenses are bound to a firewall's unique serial number, so entitlement and content updates apply only to that specific licensed device; a CDSS license must be activated and tied to the serial before its features take effect.
- A zone protection profile attaches to a security zone and enforces SYN/ICMP flood and reconnaissance (port scan, host sweep) protection on all ingress traffic before security policy rules are evaluated, independent of individual rules.
- An interface management profile explicitly permits chosen management services (HTTPS, SSH, ping) and source addresses on a Layer 3 data-plane interface; without it, management access is not allowed on data interfaces.
- In HA, HA1 is the control-plane link carrying heartbeats, hello messages, and configuration sync, while HA2 is the dedicated data-plane link that synchronizes session and forwarding state between peers.
- A zone contains one or more same-type interfaces and each interface belongs to exactly one zone; the virtual router maintains the routing table that selects the outbound interface for Layer 3 traffic.
- Layer 3 subinterfaces give each VLAN on a trunk its own routed IP subnet; a virtual wire passes tagged VLAN traffic through transparently while still applying security policy inline.
- User-ID identity-based policy sets the Source User field (e.g., a Finance group) and requires group mapping via an LDAP server profile pointing to the domain controller; the Syslog Listener method ingests login events from WLAN controllers and NAC systems that cannot integrate with User-ID directly.
- The Cloud Identity Engine provides Directory Sync and the Cloud Authentication Service, letting all firewalls, Panorama, and Prisma Access consume the same identity data without duplicated configuration.
- Advanced Threat Prevention adds inline deep learning to the Anti-Spyware and Vulnerability Protection profiles; Advanced URL Filtering attaches via the URL Filtering profile and adds real-time web page analysis.
- An Authentication Profile defines the authentication server type and settings (LDAP, RADIUS, Kerberos, or local database) used to validate credentials.
- GlobalProtect Pre-logon maps the connection to a special 'pre-logon' user identity before the Windows user authenticates; IoT Security is enabled to gain visibility into unmanaged devices and assess their risk without new hardware.
Domain 6: Connectivity and Security
- Zero Trust segmentation limits lateral movement and reduces blast radius after a breach by enforcing least-privilege policy at boundaries; the best design creates separate zones aligned to distinct trust levels, each governed by its own policy.
- The security policy rulebase is the enforcement point that grants or denies access based on classified traffic; interzone traffic is denied by default and intrazone traffic is allowed by default when no explicit rule matches.
- In IPsec, ESP encrypts and authenticates the payload while AH provides authentication only; a tunnel interface is the logical interface that routes traffic into and out of the tunnel.
- NAT Traversal (NAT-T) lets ESP and IKE traffic pass through a NAT device; anti-replay protection tracks sequence numbers in a sliding window to block re-injected duplicate packets.
- Mismatched encryption/authentication algorithms in the IKE Crypto profile cause the Phase 1 proposal to fail; explicit proxy IDs are needed for third-party traffic-selector requirements and for multiple SAs on one tunnel.
- SSL Inbound Inspection requires importing the internal server's own certificate and private key; excluding a mutual-TLS (mTLS) application via a no-decrypt rule resolves the broken handshake that decryption would otherwise cause.
- GlobalProtect Clientless VPN gives browser-based access to specific internal web apps for unmanaged/BYOD devices; split tunneling defines which traffic uses the tunnel versus bypasses it.
- A HIP (Host Information Profile) check verifies that an endpoint meets defined security posture requirements before granting access.
- Diagnostic commands: 'show running resource-monitor' reports dataplane CPU utilization over time to confirm resource exhaustion, and 'show high-availability interface' shows the status of the HA1/HA2/HA3 links including the HA2 session-sync link.
- PAN-OS packet capture has receive, transmit, drop, and firewall stages; the drop stage records packets the firewall discards (policy denies or failed sanity checks).
- Secure SD-WAN integrates next-generation firewall security directly into SD-WAN path steering; continuous verification matters because user risk, device posture, and application behavior can change during a session.
Palo Alto Network Security Professional exam tips
- Master the NAT-before-security-policy evaluation order and the fact that the egress zone is chosen by a route lookup on the post-NAT destination address - this trips up many candidates on policy questions.
- Know the two decryption types cold: SSL Forward Proxy (outbound, uses the Forward Trust CA to sign impersonation certs) versus SSL Inbound Inspection (inbound, requires the real server cert and private key on the firewall).
- Memorize the HA link roles - HA1 is control-plane (heartbeats/config sync), HA2 is data-plane (session state) - since exam scenarios test which link a symptom points to.
- For any CDSS or subscription question, remember that licensing alone does nothing; the corresponding security profile must be attached to a security policy rule before protection takes effect.
- Distinguish the App-ID states (unknown-tcp, unknown-udp, incomplete) from application-default, which is a policy service setting - a common distractor pattern on the exam.
Study guide FAQ
What is the passing score and format of the NetSec-Pro exam?
The exam runs for 90 minutes and covers six domains across NGFW and SASE. Palo Alto Networks sets the passing score at 860 on a 300-to-1000 scale for every one of its certification exams.
What is the difference between SASE and SSE for this exam?
SSE bundles cloud-delivered security services (SWG, CASB, ZTNA, FWaaS) but excludes networking, while SASE combines those same SSE security services with SD-WAN networking. Prisma Access is Palo Alto Networks' SASE platform.
How does App-ID differ from traditional port-based firewalling?
App-ID identifies the actual application in a session regardless of the port or protocol it uses, so policy can allow or block the application itself rather than trusting or blocking a port number.
What is Strata Cloud Manager (SCM) and why does it matter?
Strata Cloud Manager is the unified cloud-delivered management console spanning on-premises NGFWs, Prisma Access, and SD-WAN, giving a single place to configure policy, view logs, and apply best-practice and AIOps insights across a hybrid deployment.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- Palo Alto Networks - Network Security Professional datasheetlink and content verified 8 September 2026Six domains totalling 100%: Network Security Fundamentals 17%, NGFW and SASE Solution Functionality 13%, Platform Solutions, Services, and Tools 30%, NGFW and SASE Solution Maintenance and Configuration 10%, Infrastructure Management and CDSS 17%, Connectivity and Security 13% - the domain weights used by CertGrid practice exams exactly.
- Palo Alto Networks - certification handbooklink and content verified 8 September 2026"For ALL Palo Alto Networks Certification exams, the converted raw passing score is 860 on a scale of 300 to 1000." That single sentence settles the pass mark for all seven guides, and it is why five of them no longer say "a scaled passing score of 700" - 700 is CertGrid's own grading threshold, never Palo Alto's. The handbook also explains why the figure is scaled: cut scores are set per exam form by the Certification Committee, and scaling absorbs the difficulty variation between forms.
The vendor does not publish this. Palo Alto publishes neither an item count nor an exam length on its certification pages, in the datasheets or in the handbook - the handbook sends candidates to Pearson VUE for the appointment time, and notes that the time shown there is the whole appointment, including reading the candidate agreement, rather than answering time. So the 90 minutes on this guide is unverified from Palo Alto's own documents, and the question count is already shown as "Varies" rather than as a Palo Alto figure.